CVEvulnerability
CVE-2022-27906
5.9 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-03-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-22
Description
Mendelson OFTP2 before 1.1 b43 is affected by directory traversal. To access the vulnerable code path, the attacker has to know one of the configured Odette IDs of the OFTP2 server. An attacker can upload files to the server outside of the intended upload directory.
Affected configurations
• mendelson oftp2 (< 1.1b43)
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://insinuator.net/2022/03/a-tale-of-an-oftp2-vulnerability/ Technical Description, Third Party Advisory
- https://mendelson-e-c.com/node/3355 Release Notes, Vendor Advisory
- https://insinuator.net/2022/03/a-tale-of-an-oftp2-vulnerability/ Technical Description, Third Party Advisory
- https://mendelson-e-c.com/node/3355 Release Notes, Vendor Advisory